Any organization can use CSF 2.0 across business units, suppliers, services and technology environments. The scope of a working profile should be stated explicitly.
Practice frameworks / Cyber risk framework
NIST Cybersecurity Framework 2.0Organize cyber risk around outcomes
A common language for deciding which cybersecurity outcomes matter to an organization, how far current practice reaches and where to invest next.
Start with applicability
What it actually covers
It connects executive risk decisions to operational work without forcing every organization into the same control set.
The six functions describe outcomes, not a universal technical checklist. NIST does not certify or endorse a CSF implementation. A crosswalk to a regulation or control catalog does not establish compliance.
The substance
Key areas to understand
An original operational reading of the official framework or legal text. Check the source for the authoritative wording.
Six concurrent functions
Govern sets the risk context and accountability. Identify, Protect, Detect, Respond and Recover describe the continuing work needed to understand exposure, limit harm and restore services.
Core outcomes
Functions contain categories and subcategories. Teams select and interpret outcomes against their mission, threat exposure and obligations, then choose suitable implementation methods.
Current and target profiles
A Current Profile records outcomes in place and the evidence behind them. A Target Profile records desired outcomes and priority. The gap becomes an owned improvement plan.
Implementation tiers
Partial, Risk Informed, Repeatable and Adaptive characterize how risk governance and management are practiced. A tier is context for decisions, not a score that automatically proves security.
References and examples
NIST links outcomes to implementation examples and other publications. These help select practical safeguards, but they are not an exhaustive or mandatory recipe.
From reference to work
A practical starting sequence
These steps organize work; they are not a claim that a short checklist completes the requirement.
Set the boundary
Choose the service or organizational scope, decision owner, critical assets, stakeholders and risk tolerance before scoring outcomes.
Record the present state
For the selected subcategories, capture the actual process, owner, operating evidence and known gaps rather than a self-declared maturity label.
Agree on a target
Prioritize target outcomes by business impact, threat exposure and legal or contractual duties; assign a date and accountable owner for each improvement.
Review the profile
Revisit the plan after major service changes, incidents, supplier changes and scheduled risk reviews; test whether the evidence shows the intended result.
Make it inspectable
Evidence to look for
The right records depend on the entity, scope and chosen assessment route.
- Defined scope and risk decisions
Document the systems, services, stakeholders, risk appetite and executive decisions that shape the profile.
- Current and target profile
Keep the chosen outcomes, present state, desired state, rationale and owners in a versioned register.
- Control operating records
Link each claimed outcome to configuration, test, training, supplier or response evidence appropriate to its scope.
- Improvement trail
Track gap decisions, funded actions, acceptance of residual risk and review dates.
Illustrative situation
What this could look like
A mid-sized cloud service provider uses a Current Profile to show that supplier risk is governed but recovery tests are inconsistent. Its Target Profile sets a tested recovery objective, assigns owners and budgets a quarterly exercise.
Keep the role clear
The six functions describe outcomes, not a universal technical checklist. NIST does not certify or endorse a CSF implementation. A crosswalk to a regulation or control catalog does not establish compliance.
Related, not equivalent
Where ISO/IEC can help
ISO/IEC 27001 can provide the management-system discipline and risk treatment record; ISO/IEC 27002 offers control guidance. CSF outcomes may help explain the desired result, but a mapping between the publications is not proof of conformity.
Common distinctions
Questions worth asking
Does CSF 2.0 require every function to be implemented identically?
No. The functions are a complete view of cyber risk work, while an organization selects and prioritizes outcomes for its stated scope and risk context.
Can an organization be NIST CSF certified?
NIST states that it does not offer CSF certifications, endorsements or a conformity assessment program.
Is CSF the same as NIST SP 800-53 or the AI RMF?
No. CSF organizes cybersecurity outcomes; SP 800-53 is a control catalog. NIST AI RMF 1.0 addresses AI system risk through a separate voluntary framework and is under revision.
Primary-source trail
Read the official material
Research checked 2026-10-20. Edition, applicability and implementation rules can change. The links below take you to the responsible publisher or authority.